2024-01-27_710a3ca4cc7175b7a0656e3f2e63a683_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-27_710a3ca4cc7175b7a0656e3f2e63a683_icedid
Size

236KB
MD5

710a3ca4cc7175b7a0656e3f2e63a683
SHA1

ba614d89a6cb8172743e9ea85d780ae1468c36dc
SHA256

ab5a3f6fd45e96c869c30213d493955ca37226bb517b37736993f650c32c65b5
SHA512

521e4885615eaed5dc3dc1eabf776fb4467ac92d201126dd1d6cf7ddca4218bcc9b069b477beb4533259bfd989704f8dff57cc1410e6bdf34d027b910bef50b3
SSDEEP

3072:XM+zbyJHTKwmFoDeDAEQVe7lubUjZeNaRL0oK7jRFuX9eMn1brW/t8ilFfh3Wr:XXz2HTK0EQVeAIzPmji0uGzh4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-27_710a3ca4cc7175b7a0656e3f2e63a683_icedid

Files

2024-01-27_710a3ca4cc7175b7a0656e3f2e63a683_icedid
.exe windows:4 windows x86 arch:x86

483f29a7f6671d56041532f099be1784

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
TerminateProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
ExitProcess
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
GetLastError
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapFree
HeapAlloc
RtlUnwind
GetTickCount
SetErrorMode
GetFileTime
GetFileAttributesA
FileTimeToLocalFileTime
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FileTimeToSystemTime
InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
GetModuleHandleA
GetProcAddress
SetLastError
MulDiv
FormatMessageA
lstrcpynA
LocalFree
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
MultiByteToWideChar
GlobalAlloc
GlobalLock
GetModuleFileNameA
GlobalUnlock
GlobalFree
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
lstrlenA
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCurrentProcess
CreateMutexA
GetSystemTimeAsFileTime

user32

PostThreadMessageA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
ReleaseCapture
SetCapture
CharNextA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
wsprintfA
DestroyMenu
SetWindowContextHelpId
MapDialogRect
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
PostQuitMessage
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
IsWindow
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
MessageBoxA
GetKeyState
IsWindowVisible
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
GetParent
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
OffsetRect
IntersectRect
RegisterClipboardFormatA
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
RegisterWindowMessageA
CharUpperA
SetCursorPos
SetWindowPos
LoadCursorA
SetCursor
GetSystemMetrics
LoadIconA
KillTimer
SetTimer
GetClientRect
GetSystemMenu
PostMessageA
AppendMenuA
DrawIcon
GetPropA
SetForegroundWindow
GetLastActivePopup
GetWindow
GetDesktopWindow
IsIconic
FindWindowA
SendMessageA
EnableWindow
GetCapture

gdi32

GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetWindowExtEx
GetViewportExtEx
DeleteObject
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
GetDeviceCaps
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
PtVisible

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueA
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
GetUserNameA
AdjustTokenPrivileges
RegEnumKeyA
RegOpenKeyExA
RegOpenKeyA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoTaskMemFree
CLSIDFromString
CoRevokeClassObject
CLSIDFromProgID
CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize

oleaut32

VariantChangeType
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysAllocStringLen
VariantInit
SysAllocStringByteLen
SysStringLen
SysAllocString
VariantClear
SysFreeString

ws2_32

accept
socket
select
htonl
bind
WSAGetLastError
WSASetLastError
connect
closesocket
recvfrom
WSAAsyncSelect
send
recv
gethostname
gethostbyname
inet_ntoa
htons
inet_addr
setsockopt
WSACleanup
WSAStartup
ntohs
sendto

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

483f29a7f6671d56041532f099be1784

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

Sections

.text Size: 160KB - Virtual size: 157KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 16KB - Virtual size: 13KB

.text
Size: 160KB - Virtual size: 157KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 16KB - Virtual size: 13KB